          (integer? serial)]
    :post [(ssl-cert? %)]}
   (let [cert-keys (gen-keys certname)]
-    (assoc cert-keys :cert (gen-cert*
-                             (dissoc ca-cert :cert)
-                             cert-keys
-                             serial))))
+    (assoc cert-keys :cert (gen-cert* ca-cert cert-keys serial))))
 
+;; TODO Add final optional `options' map for :key-length and :extensions
 (defn gen-self-signed-cert
   [certname serial]
   {:pre [(string? certname)

     :x500-name (ssl-utils/cn certname)
     :certname certname}))

(defn gen-cert*
  [ca-keys host-keys serial]
  {:pre [(ssl-keys? ca-keys)

      (:public-key host-keys)
      [])))

;; TODO Add final optional `options' map for :key-length and :extensions
(defn gen-cert
  [certname ca-cert serial]
  {:pre [(string? certname)
